CCSP · Question #447
When is a virtual machine susceptible to attacks while a physical server in the same state would not be?
The correct answer is D. When it is powered off. A virtual machine's entire state - including its disk image, memory snapshots, and configuration files - exists as files on the host's storage system. Even when a VM is powered off, those files remain accessible to anyone with access to the hypervisor or underlying storage. An…
Question
When is a virtual machine susceptible to attacks while a physical server in the same state would not be?
Options
- AWhen it is behind a WAF
- BWhen it is behind an IPS
- CWhen it is not patched
- DWhen it is powered off
How the community answered
(45 responses)- B4% (2)
- C2% (1)
- D93% (42)
Explanation
A virtual machine's entire state - including its disk image, memory snapshots, and configuration files - exists as files on the host's storage system. Even when a VM is powered off, those files remain accessible to anyone with access to the hypervisor or underlying storage. An attacker (or a malicious insider) could mount the VM's disk image offline, read or modify its contents, exfiltrate data, or inject malware without ever powering on the VM. A physical server, when powered off, has its data locked on physical hardware that requires physical access and active power to read in most circumstances. This 'offline attack surface' is a unique vulnerability introduced by virtualization and does not exist for powered-off physical servers in the same threat model.
Topics
Community Discussion
No community discussion yet for this question.